Index: creddy/creddy.c
===================================================================
--- creddy/creddy.c	(revision 0aaa651e98d0786b808d4c240e05b943112f0a97)
+++ creddy/creddy.c	(revision 405bba33ad37462b405b73999d4b42c0b80a7eae)
@@ -270,7 +270,8 @@
     else if (opts->mode == MODE_DISPLAY)
         printf(
-            "Usage: creddy --display --show=[issuer,all] --cert <cert>\n"
+            "Usage: creddy --display --show=[issuer,..,all] --cert <cert>\n"
             "   values for --show are comma-separated:\n"
             "       issuer      DN of issuer\n"
+            "       validity    validity period\n"
             "       all         all of the above\n"
             "   cert may be X.509 identity or attribute cert\n"
Index: creddy/creddy.h
===================================================================
--- creddy/creddy.h	(revision 0aaa651e98d0786b808d4c240e05b943112f0a97)
+++ creddy/creddy.h	(revision 405bba33ad37462b405b73999d4b42c0b80a7eae)
@@ -3,4 +3,5 @@
 
 #include <stdio.h>
+#include <time.h> // for time_t
 
 #include <abac_common.h>
@@ -36,4 +37,7 @@
 // caller must free the returned string
 char *creddy_id_issuer(creddy_id_t *id);
+
+// get the validity period of the cert
+void creddy_id_validity(creddy_id_t *id, time_t *not_before, time_t *not_after);
 
 // default filename for the cert: ${CN}_ID.pem
Index: creddy/display.c
===================================================================
--- creddy/display.c	(revision 0aaa651e98d0786b808d4c240e05b943112f0a97)
+++ creddy/display.c	(revision 405bba33ad37462b405b73999d4b42c0b80a7eae)
@@ -2,4 +2,7 @@
 
 #include "creddy_common.h"
+
+// helper
+static void _print_validity(time_t not_before, time_t not_after);
 
 void display_main(options_t *opts) {
@@ -12,4 +15,5 @@
 
     int show_issuer = 0;
+    int show_validity = 0;
     char *opt;
 
@@ -17,6 +21,9 @@
         if (strcmp(opt, "issuer") == 0)
             show_issuer = 1;
+        else if (strcmp(opt, "validity") == 0)
+            show_validity = 1;
         else if (strcmp(opt, "all") == 0) {
             show_issuer = 1;
+            show_validity = 1;
         }
         else {
@@ -31,5 +38,12 @@
         if (show_issuer) {
             char *issuer = creddy_id_issuer(id);
-            puts(creddy_id_issuer(id));
+            printf("Issuer: %s\n", issuer);
+            free(issuer);
+        }
+
+        if (show_validity) {
+            time_t not_before, not_after;
+            creddy_id_validity(id, &not_before, &not_after);
+            _print_validity(not_before, not_after);
         }
 
@@ -46,5 +60,11 @@
     if (ac != NULL) {
         if (show_issuer)
-            printf("%Y\n", ac->get_issuer(ac));
+            printf("Issuer: %Y\n", ac->get_issuer(ac));
+
+        if (show_validity) {
+            time_t not_before, not_after;
+            ac->get_validity(ac, NULL, &not_before, &not_after);
+            _print_validity(not_before, not_after);
+        }
 
         DESTROY_IF(ac);
@@ -55,2 +75,16 @@
     errx(1, "Couldn't load %s as an ID or attribute cert", opts->cert);
 }
+
+// display the validity period of a cert
+static void _print_validity(time_t not_before, time_t not_after) {
+    char buf[256];
+    struct tm time_tm;
+
+    printf("Validity:\n");
+
+    strftime(buf, sizeof(buf), "%F %T %Z", localtime_r(&not_before, &time_tm));
+    printf("    Not before: %s [%lld]\n", buf, (long long)not_before);
+
+    strftime(buf, sizeof(buf), "%F %T %Z", localtime_r(&not_after, &time_tm));
+    printf("    Not after:  %s [%lld]\n", buf, (long long)not_after);
+}
Index: creddy/id.c
===================================================================
--- creddy/id.c	(revision 0aaa651e98d0786b808d4c240e05b943112f0a97)
+++ creddy/id.c	(revision 405bba33ad37462b405b73999d4b42c0b80a7eae)
@@ -151,4 +151,11 @@
 
     return ret;
+}
+
+/**
+ * Get the validity period.
+ */
+void creddy_id_validity(creddy_id_t *id, time_t *not_before, time_t *not_after) {
+    id->cert->get_validity(id->cert, NULL, not_before, not_after);
 }
 
